On Sun, May 1, 2022 at 12:14 PM Dan Čermák <dan.cermak(a)cgc-instruments.com>
wrote:
They are going to break things, but Ubuntu 22.04 deprecated SHA1
signatures already, so it's very likely that a good chunk of the fallout
will be cleared by the time Fedora 38 and 39 ship.
In a similar (parallel) discussion related to future RHEL, it has been
found this change also breaks resolution of many DNSSEC-secured domains
which are still using SHA1 signatures. It is impossible to know how long it
will be before those domains upgrade to better signatures, and at the
moment it's rather challenging for resolvers to be able to determine that
the resolution failure was caused by local policy instead of an actual
invalid signature.